NAT all traffic from alias except a single port/IP
-
Checking traffic graphs, interface stats and the speeds are not what they should be. Speeds should be flying when not on the VPN, but i'm seeing quite slow speeds.
-
That's no way to test routing. All you should be caring about it what interface your traffic is going out on. Performance is another issue.
Does https://www.wimi.com/ show you your PIA address or your WAN_DHCP address?
-
That's no way to test routing. All you should be caring about it what interface your traffic is going out on. Performance is another issue.
Does https://www.wimi.com/ show you your PIA address or your WAN_DHCP address?
I specified that i am looking at my traffic graphs/interface stats which show the traffic that is going in/out on my 192.168.1.62 machine is being routed through the OPT1TOPIA interface. The OPT1TOPIA interface is nearly the same as the LAN/WAN interface when testing. The 192.168.1.62 machine is a linux box and testing it via cmd line to ipchicken shows that it is using the OPT1TOPIA IP address, though i'm not sure how to test a specific port. Not sure if you'd be able to verify that only port 443 is going through a different IP address via ipchicken or wimi.
All of the traffic going to 192.168.1.62 is going through the OPT1TOPIA interface in my graphs and logs. Performance is directly related to VPN connectivity since PIA doesn't have the bandwidth to support my full 300mbps download bandwidth.
-
Well, what you have posted looks right so you must have something someplace else. Did you mess around in floating rules?
-
I haven't touched much other than that what you're seeing. These were the instructions i followed to get PIA OpenVPN setup to only that alias:
https://forum.pfsense.org/index.php?topic=72902.msg397636#msg397636
-
Doesn't matter what a walkthrough says. What matters is what your config is.
There must be something somewhere else or it would be working.
If you disable the VPN is 192.168.1.62 happy routing out the WAN_DHCP interface?
-
I was just giving a reference to what I did.
I will test that in a bit as i'm not home.
-
Yes, the 192.168.1.62 machine is fine with routing directly through the WAN interface. Have to clear states to get it to behave that way though since it holds on to the OPT1TOPIA interface until states have been refreshed.
EDIT: I do also notice that it helps restarting the 192.168.1.62 machine when making those changes or else it stays in a funky state. Upon rebooting it behaves at it should through the WAN_DHCP interface.
-
I was able to figure this out! Attached are the rules. I figured out that it was traffic on port 563 that was needed and did a bi-directional rule.
Is there any easier way to do bi-directional rules than how i did it here?
 -
The first rule with the source port 563 is probably doing nothing.
There is no such thing as a bi-directional rule on an interface tab. They only match traffic being received by that interface.
The firewall state is created which automatically allows return traffic for that connection.
